Open consultation

Draft due diligence

Published 20 July 2026

The following general direction has force of law under Data-gathering (Ongoing Data) Regulations 2026

Introduction

The Data-gathering (Ongoing Data) Regulations 2026 introduce new mandatory due diligence requirements for those persons (‘relevant persons’) who are required under the Regulations to provide data to HMRC.

Regulation 6 of the Data-gathering (Ongoing Data) Regulations 2026 says that before providing ongoing data to HMRC, data providers must take such steps to verify the data as may be specified by HMRC by published notice. This notice sets out, in accordance with regulation 6, the steps which must be taken to verify data provided under the Data-gathering (Ongoing Data) Regulations 2026.

Relevant persons are required to verify various types of data in accordance with the general requirements set out below. There are also additional verification requirements in relation to one specific category of data, namely Tax Identification Numbers (TINs).

Verification of information

t is a key requirement of the regulations that relevant person verify the information provided to them from their customers to enable us to reliably use it. Failure to verify the required information could lead to a penalty being charged on the relevant person.

The obligation to verify information only applies to information required to be collected from the customer: the customer’s name, primary address, TIN, date of birth. All of these should be verified in line with pre-existing Know Your Customer checks, except for TINs which have a separate procedure, outlined in the next section. The verification activities that must be undertaken will depend on the nature of the relevant person’s business, the information it has available, and the data provider’s wider checks, information collection and other policies. Other information which the relevant person must report, such as interest paid to the customer or total sales, will be produced by the relevant person, and so is not subject to an additional verification requirement.

Relevant persons are expected to consider the available information in the round. The overarching obligation is for the relevant person to satisfy itself that the information it has collected is reliable. Relevant persons should look out for any discrepancies, inconsistencies or gaps in the information they have collected. Where any such issues are identified, the relevant persons are expected to take further steps to verify the information collected.

Due diligence procedures for Tax Identification Number verification

An additional degree of verification, beyond that applying to customer data generally under the rules set out, applies in relation to TINs. Relevant persons will be required to use all records available, as well as any publicly available electronic interface, to ascertain the validity of the TINs. For example:

• National Insurance Numbers (NINOs)
• Company Registration Numbers (CRNs)
• VAT Registration Numbers (VRNs)

National Insurance Numbers

We expect relevant persons to ensure the NINOs they are collecting from their customers are in the correct alpha-numeric format — such as 2 letters, 6 numbers, and the final character being either A, B, C or D. Relevant persons should consider steps to remediate instances where a customer provides a NINO when signing up, but the NINO provided is clearly in a ‘dummy’ format that replicates the alphanumeric format but is unlikely to be valid, for example AA123456A, such as instances where there is reasonable doubt as to whether the NINO provided was reliable.

Company Registration Numbers

Merchant acquirers and payment service providers are expected to verify the CRN for incorporated entities using Companies House by conducting a name and number match against their records.

VAT Registration Numbers

Merchant acquirers may use the government’s ‘Check a UK VAT number’ tool to verify VRNs. For entities part of a VAT Group, merchant acquirers may need to obtain the 12 digital VAT number to be able to accurately verify the VRN using the VAT checker. The 12-digit VAT number is a variation used by branch traders; it consists of your standard 9-digit VAT number followed by a 3-digit suffix that indicates a specific branch.

Guidance

Verifying unreliable information

Where a relevant person has doubts about the reliability of the information it has collected, it will need to consider what next steps to take to verify that information to ensure it is correct. HMRC cannot prescribe what these next steps must be, as they will depend on the circumstances of the customer in question, the relevant person’s business model, the information you already holds, and the cause and the level of doubt regarding the reliability of the information.

Next steps that relevant persons may take where they have doubts as to the reliability of information could include:

• asking the customer to re-confirm the information provided, to ensure there are no mistakes
• contacting the customer to discuss the reason for the doubt and seeking an explanation from the customer to address the concern
• using any publicly available information
• using publicly available automatic checking tools or apps to confirm the correct format or structure of a tax identification number
• using software to verify the customer’s identity, as is currently used by some AML-obliged persons

This list is not exhaustive or prescriptive, and relevant persons are free to take such other measures as they deem appropriate in the circumstances.

Record keeping and retention

Relevant persons are required to keep all records relating to their due diligence procedures. This includes:

• all information that relevant persons have collected in the course of applying the due diligence procedures
• information on the steps taken by the relevant persons to comply with the identification, collection and verification requirements

It is not possible to provide an exhaustive list of documents relevant persons should retain. Relevant persons should keep any documents that will help them to demonstrate to HMRC that they have carried out the required due diligence.

Relevant persons should retain this information for a period of five years after the end of the Reportable Period to which the records relate. Customer information relates to the reportable period in which it was collected from the customer or generated by the relevant persons, but it also relates to any previous reportable period in which the data holder relies on that information.

HMRC may request this information from the relevant person (data-holder), if necessary, as part of its compliance activities to ensure that relevant persons are meeting their due diligence obligations under the regulations.

Collecting NINOs for new accounts


As part of the onboarding process for new customers, relevant persons must request the NINO or obtain a declaration from the customer that they do not hold a NINO. In the scenario that the individual is eligible but does not have one at the point of opening an account, the relevant persons may open the account but has 45 days to obtain the NINO from the customer. The customer should be directed as to how they could apply for a NINO.

If the NINO is not provided within 45 days:

• relevant persons should consider account closure

Broadly, an individual will have, or is eligible to apply for, a NINO if they are over the age of 16 and:

• is planning to (and have the right to) work and have a national insurance liability
• is claiming benefits
• has applied for a student loan
• is paying class 3 voluntary National Insurance contributions (NICs)

NINOs are commonly used to help identify and support improved matching to taxpayer records and are sensitive pieces of information. Therefore, data-holders are expected to hold, store and transmit the data securely, in line with the General Data Protection Regulations (GDPR), as they do with other sensitive information such as names, dates of birth and addresses.

Collecting NINOs for existing accounts

We expect relevant persons to make ‘reasonable efforts’ to obtain the NINO for existing accounts.

Reasonable efforts, in this respect, will mean data providers will have to reach out to customers for the first 2 years (once a year) of the new reporting obligations. If after 2 attempts, the relevant person is unable to obtain the NINO (and other identifying information where missing, such as name, date of birth and address), the only other time we would expect further attempts is whenever you are updating your Know Your Customer (KYC) checks.

Financial institutions may use any appropriate method to communicate with their customers to provide the NINO, for example writing to the customer, or communication via an app

We recognise that there are known limitations of NINOs. For example, a small minority of account holders will not have one, such as those under the age of 16 and recent migrants to the UK. If the relevant person is satisfied that the individual is ineligible, we will keep the information provided under review and audit against our records to ensure accuracy.

General guidance around NINO collection

In the unlikely scenario that an individual is ineligible for a NINO but wishes to have, or has, a savings account, the financial institution should provide the information (designatory data) they would normally have on them.

For joint accounts, the NINO will need to be obtained on all reportable individuals.

The NINO should only be collected for the beneficiary/beneficiaries of the account.

For inactive accounts where the NINO and other KYC information is missing — inactive account is defined as per each financial institution policy, which we understand to normally be after no customer-initiated transaction for 3 to 4 years (although may vary). If the customer tries to reactivate the account, they must be asked for their NINO (and other identifying information).

When do Due Diligence procedures have to be carried out?

The regulations do not specify when these procedures should be undertaken, so it is up to relevant persons to decide whether to carry them out as part of any initial onboarding process or at some later stage during the reportable period. HMRC anticipates that in practice relevant persons will normally find it easiest to collect information from customers at onboarding, as part of the registration process, rather than trying to collect the information later.

More generally, to ensure the information they hold and report is reliable, relevant persons may wish to consider what steps they can take to encourage customers to update their details, for example by asking customers to confirm information held by the relevant person is still correct. Steps such as this could help data holders to ensure the information they collect and provide is reliable.

Mandating suppliers to obtain/request tax references for companies, businesses and traders

For any UK incorporated companies we are seeking the CRN for both new and existing accounts. CRNs are in the public domain (they can be found on Companies House); therefore, they carry less risk around storage and disclosure.

In addition to the CRN, we expect merchant acquirers to request VRN as part of onboarding and where missing as part of your ongoing KYC checks.

The above only applies to merchant acquirers.

Penalties

There is a penalty of up to £100 per account if a relevant person fails to apply due diligence procedures. There is a penalty of up to £5000 for a failure to keep or preserve records.